Fix a security issue with IP lock when is_proxy_used is set to True

We were using the first element of the list in the X-Forwarded-For HTTP
header as the client's IP address but, since most proxies just append to
it, the client is able to arbitrarily set a prefix. Therefore the
extracted IP address was unreliable and the IP lock insecure. Taking the
last element of that list fixes the issue.

Activating "is_proxy_used" when clients are allowed to directlty connect
to CWS remains as insecure as it always has been (i.e. a lot!).

This commit introduces a regression: a chain of multiple proxies isn't
supported anymore.